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Events/Log Analysis - Theory 


¢ 2016/101:13:34:05.34 ORB Entering Eclipse. Duration = 12:34.000 


¢ Historically, we have put tremendous effort into processing and displaying 
housekeeping telemetry. 


— We convert it, combine it, limit-check it, plot it, and trend it. We even draw dials and thermometers. 


¢ Events/Log messages have received much less attention 
¢ Once a message scrolls off the screen, we often never see it again 
¢ Limited use for automation and for notifying team of issues via email or texting 
¢ Logs are often in each local system and not viewed together 
¢ Perl scripts sometimes developed to help analyze the logs 


— Itis the logs that know when commands were resent, when there were data drop outs or system 
failures, when people log on and off, and much much more. 


¢ What could we do better? 
— Bring together the logs of multiple systems to increase situational awareness 
— Express many of our non-telemetry items as event/log messages 


— Create new display and analysis tools to provide powerful new situational awareness and 
operations support capabilities 
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First, let’s collect the information 


¢ Combine existing logs 
— With GMSEC open pub/sub architecture, components each publish their event messages and a 


single archive can be created 
em] 


GMSEC Message Bus and API 


¢ Allow a “NOTE” capability 
— Allow users to add their own notes for the record 
— Simple app that publishes a text message to the bus 


¢ Add in information from other products 
— Translate products to sets of time-tagged text msgs 
— Working with the OMG on log message structure standard 


Great News: Now we have lots and lots of time-tagged text data to work with! 
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Now we have a problem! S 


¢- Some missions may have 50,000 or more messages per day! 


¢ With new levels of automation, there may not even be any operators 
on-console to watch displays 


¢ AS we move towards constellations and enterprise systems, we will be 
mixing satellites in the same logs 


¢ Out of sight > Out of mind 


If we have a huge message log, but nobody can use it, 
do we even have a message log? 
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How can we display 1,000’s of messages? asal 


¢ Enhanced message log display — similar to today’s capabilities 
— Simplify the dynamic filters for the users 
— Enable color coding of message fields, not just of entire line 


BoB2ove08 


¢ “Ticks and Bars” Display 
— User defines the lines of the display 
— TICK, Title = “COMMANDS SENT”, Find = “/CMD” 
¢ Display will show a small mark on a time scale for each command sent 
— BAR, Title = “ECLIPSE”, Start = “Eclipse Entry”, End = “Eclipse exit” 
¢ Display will show a bar on a time scale depicting eclipse period 
Zoomable time scale; event message viewer at bottom of display 
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Ticks and Bars Display Capability asa 


Time Scale (zoomable) 
CMDS Sent ii od HI 
Alarms Pt Wen 
Sched. Passes —— 
Actual Passes — 


Event/Log Messages (time tags, flags, source, text) Scrollable within above time range 
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Ticks and Bars Display — Team Staffing 


Time Scale (zoomable) 


Dawn 
Dan 
George 
Hillary 
Pete 
Monica —— —— —_ 


Kelvin a SaaS 
Richard 
Karen 


Event/Log Messages (time tags, flags, source, text) Scrollable within above time range 
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What can we learn from 1,000’s of messages? asa 


¢ “Ask Jim” — Query Capabilities 
— Structured language to allow for smart searching of the events logs. 
— Key words or phrases: How many ..., When did. . ., For how long, ... 
— Key time words: TODAY, YESTERDAY, etc. 
— Response could be an English sentence response or a set of messages. 


User specifies enough information to find the needed messages 
— Time span, text-match information 


¢ Tool can FIND, COUNT and COMPUTE-DURATION 


Could have FAQs and user-defined keywords to simplify user input 


¢ Sample Queries 
— QUESTION: How many commands did we send today? 
— RESPONSE: As of 18:30 today, 237 commands have been sent 
— QUESTION: When did we send command HEATER_1A_ON? 
= RESPONSE: Command HEATER_1A_ON was last sent on Day 63 at 13:42:05 
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Let’s get more advanced 


Event-based automation (already available) 
More sophisticated queries 
— Compound queries 
— Ability to exclude certain messages 
Auto-generation of shift/status reports based on event message analysis 
Text-Based Data Analytics 
— Discover/learn trends or sequence “signatures” 
— Cross-vehicle assessment 's, 8 
Move to natural language interface 
— Allow broader search ability 
— Support voice recognition 
Create a Ops Assistant 
— Imagine an Amazon Echo for each ops position 
— What would the conversation be? 


Access to telemetry values and event messages could be seamless, allowing queries, 
reports, and displays to easily intermix the two 


— Time frame on plots could be based on query to event log (ie. Plot parameters x, y, and 
z for the last orbit, or for when John was logged on yesterday. 
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Summary asa 


¢ We think that the set of events/log message enhancements will provide 
powerful capabilities for the mission user regardless of Agency or type 
of mission 


¢ Placing an emphasis on non-telemetry analysis opens up a new area of 
data mining, analytics and tool development — we think the users will 
help identify even more functions 


¢ This is a great set of applications for mission operations, especially 
using the GMSEC architecture— the tools will work regardless of what 
other products are part of the configuration; it works by monitoring traffic 
on the bus; and is not reliant on any specific vendor products. 
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Over the Horizon... asa 


Could combine event message analysis and analytics with personal 
“Amazon Echo-style” assistant with virtual reality view of the vehicle 
showing sun angles/shadows, instrument pointing, temperature readings, 
etc. 


a 


Clipart courtesy of pixabay.com public domain images. 
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GMSEC Log Msg Approach asa 


GMSEC Message Bus and API 


a, 
“SSP rovides: 


Current: Each 
component writes 
log messages to the 
bus. 


New: Users can 
make log entries 


1. Simplified Access 


Upgraded archive to enhance 2. Better color-coding 
speed, capacity, and queries. 3. Better filters and 


Converting file 2 SE al SO the User-defined graphical time- 
e 


creates a single In este based display of selected events. 
increase situationa awar i. 
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If | could really change things... asa 


¢ | would make event messages more like e-mail 


— We learned long ago that simply having a time, a source and some 
flags, and some text [Subject] was not enough to convey a message 


— Imagine if we could have optional body text to explain a problem in 
detail 


¢ Like the body of email messages 
¢ Could provide details on a parameter when it goes out of limits 
¢ Could include the full text of a rule that is violated 


— Imagine if we could have attachments 
¢ Could capture a screen image when a problem is noted 
¢ Could include a script that might help get out of a problem 
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